Spyware / Malware / Virus Removal

[Resolved] Blue Screen

20 min read

Looking for the outcome? Ask AI

Rio Topic Starter

Post #1January 7, 2008, 2:24 AM UTC last edited January 7, 2008, 2:53 AM UTC

IE taken over with little warning.

Spywareguard Browser Protection Alert is indicating a Warning about a BHO is trying to be added {2D1F9B87-5D38-41D0-9FCB-FB92BDF35AE2} if that makes any sense.

Ran SpyBot and cleared everything ok. Ran Adaware SE and a trojan is identified, but when I go to clean it my system goes to Blue Screen. Trojan item is "Win32.Trojandownloader.Zlob" rated as a 10 out of 10.

Appreciate your help to get rid of what ever has gotten into my system

HJT log attached.

Logfile of HijackThis v1.99.1
Scan saved at 9:17:32 PM, on 1/6/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\PSIService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD .exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01 .exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08 .exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Common Files\Real\Update_OB\realsched .exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt .exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient .exe
C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe
C:\Program Files\Creative\SBLive\Diagnostics\diagent .exe
C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe
C:\Program Files\QdrModule\QdrModule11.exe
C:\Program Files\iTunes\iTunesHelper .exe
C:\Program Files\QdrPack\QdrPack11.exe
C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader .exe
C:\Program Files\QdrModule\QdrModule11 .exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\Program Files\QdrPack\QdrPack11 .exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://smbusiness.dellnet.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://smbusiness.dellnet.com/
F3 - REG:win.ini: load=C:\WINDOWS\System32\awtst.exe
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [diagent] "C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" startup
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SpamBlocker] C:\Program Files\SpamBlockerUtility\Bin\4.7.1.0\SbOEAddOn.exe
O4 - HKLM\..\Run: [Spam Blocker for Outlook Express] C:\PROGRA~1\SPAMBL~1\Bin\471~1.0\SBInst.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [IpWins] C:\Program Files\ipwins\ipwins.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask .exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Corel Photo Downloader] "C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" -startup
O4 - HKCU\..\Run: [QdrModule11] "C:\Program Files\QdrModule\QdrModule11.exe"
O4 - HKCU\..\Run: [QdrPack11] "C:\Program Files\QdrPack\QdrPack11.exe"
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O15 - Trusted Zone: *.drivecleaner.com
O15 - Trusted Zone: *.errorprotector.com
O15 - Trusted Zone: *.imagesrvr.com
O15 - Trusted Zone: *.systemdoctor.com
O15 - Trusted Zone: *.winantispyware.com
O15 - Trusted Zone: *.winantivirus.com
O15 - Trusted Zone: *.drivecleaner.com (HKLM)
O15 - Trusted Zone: *.errorprotector.com (HKLM)
O15 - Trusted Zone: *.imagesrvr.com (HKLM)
O15 - Trusted Zone: *.systemdoctor.com (HKLM)
O15 - Trusted Zone: *.winantispyware.com (HKLM)
O15 - Trusted Zone: *.winantivirus.com (HKLM)
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall-beta.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/oas/ActiveX/MSDcode.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab
O16 - DPF: {55027008-315F-4F45-BBC3-8BE119764741} (Slide Image Uploader Control) - http://www.slide.com/uploader/SlideImageUploader.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zonelabs.com/bin/promotion…canner37500.cab
O16 - DPF: {8C875948-9C60-4381-9248-0DF180542D53} - http://installs.spamblockerutility.com/ins…ckerutility.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {B49C4597-8721-4789-9250-315DFBD9F525} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/radio/ampx/ampx2.6.1.11_en_dl.cab
O16 - DPF: {D3D83E08-54D1-4E9D-8EAF-9F979D139294} (MaxisSimCityScapeTeleX Control) - http://simcity.ea.com/scape/teleport/Maxis…yScapeTeleX.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/d…/ITDetector.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\System32\PSIService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

little eagle

Post #2January 13, 2008, 8:09 PM UTC

Download Winhelp2002's deldomain.inf to your desktop. http://www.mvps.org/winhelp2002/DelDomains.inf

Right-click on the deldomains.inf file and select 'Install'
It will not appear to have done anything, thats ok.

————————————————-

Lets try running combofix.exe
Download it from one of the links below:
Note:
It is important that it is saved directly to your desktop
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Double click combofix.exe & follow the prompts.
When finished, it will produce a log for you. Post that log in your next reply.

Note:
Do not mouseclick combofix's window while it's running. That may cause it to stall

Rio

Post #3January 15, 2008, 4:32 AM UTC

Thanks for picking up on this.

Requested combofix log attached.

ComboFix 08-01-15.3 - Mom & Dad 2008-01-14 23:05:46.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.1.1252.1.1033.18.185 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Desktop\Free PC Wallpapers.lnk
C:\Documents and Settings\Mom & Dad\Start Menu\Programs\Internet Speed Monitor
C:\Documents and Settings\Mom & Dad\Start Menu\Programs\Internet Speed Monitor\Check Now.lnk
C:\Documents and Settings\Mom & Dad\Start Menu\Programs\Internet Speed Monitor\Uninstall.lnk
C:\Program Files\Common Files\{20101~1
C:\Program Files\Common Files\{30101~1
C:\Program Files\Common Files\{30101~1\Uninst.exe
C:\Program Files\ISM
C:\Program Files\ISM\ism.exe
C:\Program Files\ISM\Uninstall.exe
C:\Program Files\QdrDrive
C:\Program Files\QdrDrive\QdrDrive9.dll
C:\Program Files\QdrModule
C:\Program Files\QdrModule\dic.gz
C:\Program Files\QdrModule\kwd.gz
C:\Program Files\QdrModule\QdrModule11 .exe
C:\Program Files\QdrPack
C:\Program Files\QdrPack\dicts.gz
C:\Program Files\QdrPack\QdrPack11 .exe
C:\Program Files\QdrPack\QdrPack11.exe
C:\Program Files\QdrPack\trgts.gz
C:\Program Files\windows adstatus
C:\Temp\fse
C:\WINDOWS\Downloaded Program Files\ODCTOOLS
C:\WINDOWS\system32\_002685_.tmp.dll
C:\WINDOWS\system32\_002862_.tmp.dll
C:\WINDOWS\system32\_002863_.tmp.dll
C:\WINDOWS\system32\_002864_.tmp.dll
C:\WINDOWS\system32\_002865_.tmp.dll
C:\WINDOWS\system32\_002872_.tmp.dll
C:\WINDOWS\system32\_002873_.tmp.dll
C:\WINDOWS\system32\_002874_.tmp.dll
C:\WINDOWS\system32\_002875_.tmp.dll
C:\WINDOWS\system32\_002882_.tmp.dll
C:\WINDOWS\system32\_002883_.tmp.dll
C:\WINDOWS\system32\_002884_.tmp.dll
C:\WINDOWS\system32\_002886_.tmp.dll
C:\WINDOWS\system32\_002887_.tmp.dll
C:\WINDOWS\system32\_002890_.tmp.dll
C:\WINDOWS\system32\_002891_.tmp.dll
C:\WINDOWS\system32\_002894_.tmp.dll
C:\WINDOWS\system32\_002895_.tmp.dll
C:\WINDOWS\system32\_002897_.tmp.dll
C:\WINDOWS\system32\_002898_.tmp.dll
C:\WINDOWS\system32\_002900_.tmp.dll
C:\WINDOWS\system32\_002905_.tmp.dll
C:\WINDOWS\system32\_002907_.tmp.dll
C:\WINDOWS\system32\_002910_.tmp.dll
C:\WINDOWS\system32\_002912_.tmp.dll
C:\WINDOWS\system32\_002913_.tmp.dll
C:\WINDOWS\system32\_002914_.tmp.dll
C:\WINDOWS\system32\_002915_.tmp.dll
C:\WINDOWS\system32\_002918_.tmp.dll
C:\WINDOWS\system32\_002920_.tmp.dll
C:\WINDOWS\system32\_002921_.tmp.dll
C:\WINDOWS\system32\_002922_.tmp.dll
C:\WINDOWS\system32\_002926_.tmp.dll
C:\WINDOWS\system32\_002928_.tmp.dll
C:\WINDOWS\system32\_002929_.tmp.dll
C:\WINDOWS\system32\_002930_.tmp.dll
C:\WINDOWS\system32\_002934_.tmp.dll
C:\WINDOWS\system32\_002936_.tmp.dll
C:\WINDOWS\SYSTEM32\000080.exe
C:\WINDOWS\SYSTEM32\000090.exe
C:\WINDOWS\system32\atvgegpu.dll
C:\WINDOWS\system32\avoevgxv.dll
C:\WINDOWS\system32\awtst.dll
C:\WINDOWS\system32\awtst.exe
C:\WINDOWS\system32\ewjrevgq.dll
C:\WINDOWS\system32\f02WtR
C:\WINDOWS\system32\fgihqiim.exe
C:\WINDOWS\SYSTEM32\gbcshjsk.ini
C:\WINDOWS\system32\iifcawv.dll
C:\WINDOWS\system32\khkcqnpw.dll
C:\WINDOWS\system32\ksjhscbg.dll
C:\WINDOWS\SYSTEM32\ltridios.ini
C:\WINDOWS\system32\ltrwqtyo.dll
C:\WINDOWS\system32\lxqnayjs.dll
C:\WINDOWS\system32\opbnljtj.dll
C:\WINDOWS\system32\otvovgts.exe
C:\WINDOWS\system32\RCX24.tmp
C:\WINDOWS\system32\RCX26.tmp
C:\WINDOWS\system32\RCX27.tmp
C:\WINDOWS\system32\RCX28.tmp
C:\WINDOWS\SYSTEM32\sjyanqxl.ini
C:\WINDOWS\system32\soidirtl.dll
C:\WINDOWS\SYSTEM32\spblkxay.ini
C:\WINDOWS\system32\tqalbwxb.dll
C:\WINDOWS\SYSTEM32\tstwa.ini
C:\WINDOWS\SYSTEM32\tstwa.ini2
C:\WINDOWS\system32\uguxbmpu.exe
C:\WINDOWS\SYSTEM32\upgegvta.ini
C:\WINDOWS\system32\vyuthxyf.dll
C:\WINDOWS\SYSTEM32\wpnqckhk.ini
C:\WINDOWS\system32\yaxklbps.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
——-\LEGACY_DOMAINSERVICE
——-\LEGACY_IPRIP
——-\LEGACY_MSDIRECTX
——-\DomainService
——-\iprip

((((((((((((((((((((((((( Files Created from 2007-12-15 to 2008-01-15 )))))))))))))))))))))))))))))))
.

2008-01-14 23:24 . 2008-01-14 23:24 329,728 ——— C:\WINDOWS\SYSTEM32\awtst.dll
2008-01-14 23:24 . 2008-01-14 23:24 318 –ahs—- C:\WINDOWS\SYSTEM32\tstwa.ini2
2008-01-14 23:24 . 2008-01-14 23:24 318 –ahs—- C:\WINDOWS\SYSTEM32\tstwa.ini
2008-01-14 23:04 . 2000-08-31 08:00 51,200 –a—— C:\WINDOWS\NirCmd.exe
2008-01-09 20:00 . 2008-01-09 20:00 d——– C:\Program Files\RcvSystem
2007-12-30 20:26 . 2008-01-14 23:24 d——– C:\Program Files\iTunes
2007-12-30 20:26 . 2007-12-30 20:26 d——– C:\Program Files\iPod
2007-12-30 15:38 . 2008-01-14 23:24 d——– C:\Program Files\QuickTime
2007-12-30 15:36 . 2007-12-30 15:36 d——– C:\Program Files\Apple Software Update
2007-12-30 15:36 . 2007-12-30 15:36 d——– C:\Documents and Settings\All Users\Application Data\Apple
2007-12-25 20:10 . 2007-03-12 16:42 3,495,784 –a—— C:\WINDOWS\SYSTEM32\d3dx9_33.dll
2007-12-24 21:24 . 2007-12-24 21:24 dr-h—– C:\Documents and Settings\Mom & Dad\Application Data\SecuROM
2007-12-24 21:24 . 2007-12-24 21:24 107,888 –a—— C:\WINDOWS\SYSTEM32\CmdLineExt.dll
2007-12-15 18:12 . 2008-01-09 19:59 88 -rahs—- C:\WINDOWS\SYSTEM32\A7A8E48894.sys
2007-12-15 13:29 . 2007-12-15 18:12 d——– C:\Documents and Settings\Mom & Dad\Application Data\Corel
2007-12-15 13:28 . 2007-12-15 13:28 d——– C:\Documents and Settings\All Users\Application Data\Corel
2007-12-15 13:23 . 2007-12-15 13:25 d——– C:\Program Files\Common Files\Corel
2007-12-15 13:16 . 2008-01-09 20:16 2,828 –ahs—- C:\WINDOWS\SYSTEM32\KGyGaAvL.sys
2007-12-15 13:13 . 2007-12-15 13:23 d——– C:\Program Files\Corel

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-07 02:44 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-01-04 12:33 ——— d—–w C:\Program Files\WebHost
2008-01-04 03:25 ——— d—–w C:\Program Files\SpywareGuard
2008-01-04 03:24 ——— d—–w C:\Program Files\SpywareBlaster
2007-12-28 02:55 ——— d—–w C:\Program Files\EA GAMES
2007-12-26 01:03 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-12-26 01:03 ——— d—–w C:\Program Files\Nancy Drew
2007-12-17 21:30 18,124,111 —-a-w C:\WINDOWS\Internet Logs\tvDebug.zip
2007-12-04 00:10 57,856 —-a-w C:\WINDOWS\Internet Logs\xDB13.tmp
2007-12-01 22:09 31,232 —-a-w C:\WINDOWS\Internet Logs\xDB12.tmp
2007-11-30 19:46 284,160 —-a-w C:\WINDOWS\Internet Logs\xDB11.tmp
2007-11-05 02:03 2,631,680 —-a-w C:\WINDOWS\Internet Logs\xDB10.tmp
2007-04-11 19:42 22,528 —-a-w C:\WINDOWS\Internet Logs\xDBD.tmp
2007-04-11 19:42 1,748,992 —-a-w C:\WINDOWS\Internet Logs\xDBF.tmp
2007-04-11 19:36 4,969,984 —-a-w C:\WINDOWS\Internet Logs\xDBB.tmp
2007-04-11 19:36 1,748,992 —-a-w C:\WINDOWS\Internet Logs\xDBC.tmp
2007-03-27 19:33 1,741,824 —-a-w C:\WINDOWS\Internet Logs\xDBA.tmp
2007-03-21 20:19 1,725,440 —-a-w C:\WINDOWS\Internet Logs\xDB9.tmp
2007-01-13 00:42 1,619,968 —-a-w C:\WINDOWS\Internet Logs\xDB8.tmp
2006-12-28 18:07 1,592,832 —-a-w C:\WINDOWS\Internet Logs\xDB7.tmp
2006-12-19 00:00 1,574,912 —-a-w C:\WINDOWS\Internet Logs\xDB6.tmp
2006-10-03 01:43 1,483,776 —-a-w C:\WINDOWS\Internet Logs\xDB5.tmp
2006-09-07 21:19 1,456,640 —-a-w C:\WINDOWS\Internet Logs\xDB4.tmp
2006-09-07 19:38 1,454,592 —-a-w C:\WINDOWS\Internet Logs\xDB3.tmp
2006-07-23 19:03 19,968 —-a-w C:\WINDOWS\Internet Logs\xDB2.tmp
2006-07-23 18:29 1,628,160 —-a-w C:\WINDOWS\Internet Logs\xDBE.tmp
2006-05-27 13:55 42,649 —-a-w C:\WINDOWS\Internet Logs\zlclient_2nd_2006_05_27_09_30_28_small.dmp.zip
2006-04-30 14:47 2,621,440 —-a-w C:\WINDOWS\Internet Logs\xDB1.tmp
2005-02-15 00:57 63,064 —-a-w C:\Documents and Settings\Mom & Dad\Application Data\GDIPFONTCACHEV1.DAT
2004-07-18 05:54 460,728 —-a-w C:\WINDOWS\Fonts\SET675.tmp
2004-07-18 05:54 460,728 —-a-w C:\WINDOWS\Fonts\SET5B1.tmp
2004-07-18 05:54 460,728 —-a-w C:\WINDOWS\Fonts\SET4C4.tmp
2004-07-18 05:54 383,140 —-a-w C:\WINDOWS\Fonts\SET674.tmp
2004-07-18 05:54 383,140 —-a-w C:\WINDOWS\Fonts\SET5B0.tmp
2004-07-18 05:54 383,140 —-a-w C:\WINDOWS\Fonts\SET4C3.tmp
2004-07-18 05:54 355,436 —-a-w C:\WINDOWS\Fonts\SET673.tmp
2004-07-18 05:54 355,436 —-a-w C:\WINDOWS\Fonts\SET5AF.tmp
2004-07-18 05:54 355,436 —-a-w C:\WINDOWS\Fonts\SET4C2.tmp
2004-07-17 18:39 409,280 —-a-w C:\WINDOWS\Fonts\SET672.tmp
2004-07-17 18:39 409,280 —-a-w C:\WINDOWS\Fonts\SET5AE.tmp
2004-07-17 18:39 409,280 —-a-w C:\WINDOWS\Fonts\SET4C1.tmp
2004-07-17 18:39 398,372 —-a-w C:\WINDOWS\Fonts\SET671.tmp
2004-07-17 18:39 398,372 —-a-w C:\WINDOWS\Fonts\SET5AD.tmp
2004-07-17 18:39 398,372 —-a-w C:\WINDOWS\Fonts\SET4C0.tmp
2004-07-17 18:39 367,112 —-a-w C:\WINDOWS\Fonts\SET678.tmp
2004-07-17 18:39 367,112 —-a-w C:\WINDOWS\Fonts\SET5B4.tmp
2004-07-17 18:39 367,112 —-a-w C:\WINDOWS\Fonts\SET4C7.tmp
2004-07-17 18:39 352,224 —-a-w C:\WINDOWS\Fonts\SET677.tmp
2004-07-17 18:39 352,224 —-a-w C:\WINDOWS\Fonts\SET5B3.tmp
2004-07-17 18:39 352,224 —-a-w C:\WINDOWS\Fonts\SET4C6.tmp
2004-07-17 18:39 127,596 —-a-w C:\WINDOWS\Fonts\SET676.tmp
2004-07-17 18:39 127,596 —-a-w C:\WINDOWS\Fonts\SET5B2.tmp
2004-07-17 18:39 127,596 —-a-w C:\WINDOWS\Fonts\SET4C5.tmp
.

—-a-w		   262,184 2008-01-15 04:24:09  C:\Program Files\AntiVir PersonalEdition Classic\avgnt .exe
—-a-w		   531,272 2008-01-15 04:24:13  C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader	.exe
—-a-w		   888,320 2008-01-10 01:27:14  C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader   .exe
—-a-w		   888,320 2008-01-07 21:32:16  C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader  .exe
—-a-w		   888,320 2008-01-07 02:52:14  C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader .exe
—-a-w		   151,597 2008-01-15 04:24:07  C:\Program Files\Common Files\Real\Update_OB\realsched .exe
—-a-w		   135,264 2008-01-15 04:24:31  C:\Program Files\Creative\SBLive\Diagnostics\diagent .exe
—-a-w			40,960 2008-01-15 04:24:04  C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01 .exe
—-a-w		   267,048 2008-01-15 04:24:11  C:\Program Files\iTunes\iTunesHelper .exe
—-a-w		   647,168 2008-01-15 04:24:33  C:\Program Files\QuickTime\QTTask	   .exe
—-a-w		   647,168 2008-01-15 04:06:38  C:\Program Files\QuickTime\QTTask	  .exe
—-a-w		   647,168 2008-01-10 01:27:07  C:\Program Files\QuickTime\QTTask	 .exe
—-a-w		   647,168 2008-01-10 00:56:44  C:\Program Files\QuickTime\QTTask	.exe
—-a-w		   647,168 2008-01-07 21:32:13  C:\Program Files\QuickTime\QTTask   .exe
—-a-w		   647,168 2008-01-07 02:52:08  C:\Program Files\QuickTime\QTTask  .exe
—-a-w		   647,168 2008-01-07 02:40:25  C:\Program Files\QuickTime\QTTask .exe
—-a-w		   684,032 2008-01-15 04:24:09  C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD .exe
—-a-w		   919,016 2008-01-15 04:24:13  C:\Program Files\Zone Labs\ZoneAlarm\zlclient .exe
—-a-w		   172,032 2008-01-15 04:24:05  C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\hpztsb08 .exe

little eagle

Post #4January 18, 2008, 5:50 PM UTC

Open notepad and copy/paste the text in the codebox below into it:

RenV::
C:\Program Files\AntiVir PersonalEdition Classic\avgnt .exe
C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader	.exe
C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader   .exe
C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader  .exe
C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader .exe
C:\Program Files\Common Files\Real\Update_OB\realsched .exe
C:\Program Files\Creative\SBLive\Diagnostics\diagent .exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01 .exe
C:\Program Files\iTunes\iTunesHelper .exe
C:\Program Files\QuickTime\QTTask	   .exe
C:\Program Files\QuickTime\QTTask	  .exe
C:\Program Files\QuickTime\QTTask	 .exe
C:\Program Files\QuickTime\QTTask	.exe
C:\Program Files\QuickTime\QTTask   .exe
C:\Program Files\QuickTime\QTTask  .exe
C:\Program Files\QuickTime\QTTask .exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD .exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient .exe
C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\hpztsb08 .exe

Save this as Save this as "CFScript"

[external image: Posted Image]

Refering to the picture above, drag CFScript.txt into ComboFix.exe

Then post the results log and a new HijackThis log.

——————————————————

Sorry for the delay email me here if I do not reply in 24hrs.
Please include a link to this thread.
This software is not sending out emails to me when you reply.

Rio

Post #5January 19, 2008, 5:37 PM UTC

Requested logs follow

ComboFix 08-01-15.3 - Mom & Dad 2008-01-19 12:16:54.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.1.1252.1.1033.18.245 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader .exe
C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader .exe
C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader .exe
C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader .exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\QTTask .exe
C:\Program Files\QuickTime\QTTask .exe
C:\Program Files\QuickTime\QTTask .exe
C:\Program Files\QuickTime\QTTask .exe
C:\Program Files\QuickTime\QTTask .exe
C:\Program Files\QuickTime\QTTask .exe
C:\Program Files\QuickTime\QTTask .exe
C:\Program Files\QuickTime\QTTask .exe
C:\Program Files\QuickTime\QTTask .exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\awtst.dll
C:\WINDOWS\system32\awtst.exe
C:\WINDOWS\system32\fmeqmqdk.dll
C:\WINDOWS\system32\gewdnuyw.dll
C:\WINDOWS\system32\pijrfdqc.exe
C:\WINDOWS\system32\qjrtjqqs.dll
C:\WINDOWS\system32\RCX1E.tmp
C:\WINDOWS\system32\RCX1F.tmp
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe
C:\WINDOWS\SYSTEM32\swcqopbg.ini
C:\WINDOWS\SYSTEM32\tstwa.ini
C:\WINDOWS\SYSTEM32\tstwa.ini2
C:\WINDOWS\SYSTEM32\wyundweg.ini

C:\Program Files\AntiVir PersonalEdition Classic\avgnt .exe —> avgnt.exe
C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader	 .exe —> Corel Photo Downloader.exe
C:\Program Files\Common Files\Real\Update_OB\realsched .exe —> realsched.exe
C:\Program Files\Creative\SBLive\Diagnostics\diagent .exe —> diagent.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01 .exe —> hpotdd01.exe
C:\Program Files\iTunes\iTunesHelper .exe —> iTunesHelper.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD .exe —> DirectCD.exe
Error moving C:\Program Files\Zone Labs\ZoneAlarm\zlclient .exe to C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe: 5.
C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\hpztsb08 .exe —> hpztsb08.exe

.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
——-\LEGACY_DOMAINSERVICE
——-\DomainService

((((((((((((((((((((((((( Files Created from 2007-12-19 to 2008-01-19 )))))))))))))))))))))))))))))))
.

2008-01-14 23:04 . 2000-08-31 08:00 51,200 –a—— C:\WINDOWS\NirCmd.exe
2008-01-09 20:00 . 2008-01-09 20:00 d——– C:\Program Files\RcvSystem
2007-12-30 20:26 . 2008-01-19 12:27 d——– C:\Program Files\iTunes
2007-12-30 20:26 . 2007-12-30 20:26 d——– C:\Program Files\iPod
2007-12-30 15:38 . 2008-01-19 12:25 d——– C:\Program Files\QuickTime
2007-12-30 15:36 . 2007-12-30 15:36 d——– C:\Program Files\Apple Software Update
2007-12-30 15:36 . 2007-12-30 15:36 d——– C:\Documents and Settings\All Users\Application Data\Apple
2007-12-25 20:10 . 2007-03-12 16:42 3,495,784 –a—— C:\WINDOWS\SYSTEM32\d3dx9_33.dll
2007-12-24 21:24 . 2007-12-24 21:24 dr-h—– C:\Documents and Settings\Mom & Dad\Application Data\SecuROM
2007-12-24 21:24 . 2007-12-24 21:24 107,888 –a—— C:\WINDOWS\SYSTEM32\CmdLineExt.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-07 02:44 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-01-04 12:33 ——— d—–w C:\Program Files\WebHost
2008-01-04 03:25 ——— d—–w C:\Program Files\SpywareGuard
2008-01-04 03:24 ——— d—–w C:\Program Files\SpywareBlaster
2007-12-28 02:55 ——— d—–w C:\Program Files\EA GAMES
2007-12-26 01:03 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-12-26 01:03 ——— d—–w C:\Program Files\Nancy Drew
2007-12-15 23:12 ——— d—–w C:\Documents and Settings\Mom & Dad\Application Data\Corel
2007-12-15 18:28 ——— d—–w C:\Documents and Settings\All Users\Application Data\Corel
2007-12-15 18:25 ——— d—–w C:\Program Files\Common Files\Corel
2007-12-15 18:23 ——— d—–w C:\Program Files\Corel
2005-02-15 00:57 63,064 —-a-w C:\Documents and Settings\Mom & Dad\Application Data\GDIPFONTCACHEV1.DAT
.

—-a-w		   919,016 2008-01-19 17:12:07  C:\Program Files\Zone Labs\ZoneAlarm\zlclient .exe

((((((((((((((((((((((((((((( snapshot@2008-01-14_23.31.37.25 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-01-15 04:05:00 479,232 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT
+ 2008-01-19 17:16:11 479,232 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT
- 2008-01-15 04:05:00 8,192 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
+ 2008-01-19 17:16:11 8,192 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
- 2008-01-15 04:05:00 5,554,176 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\NTUSER.DAT
+ 2008-01-19 17:16:11 5,554,176 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\NTUSER.DAT
- 2008-01-15 04:05:00 49,152 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
+ 2008-01-19 17:16:11 49,152 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
- 2008-01-15 04:05:00 479,232 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\NTUSER.DAT
+ 2008-01-19 17:16:11 479,232 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\NTUSER.DAT
- 2008-01-15 04:05:00 8,192 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
+ 2008-01-19 17:16:11 8,192 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
- 2007-10-29 21:53:52 53,436 —-a-w C:\WINDOWS\SYSTEM32\PERFC009.DAT
+ 2008-01-15 04:26:39 53,436 —-a-w C:\WINDOWS\SYSTEM32\PERFC009.DAT
- 2007-10-29 21:53:52 381,692 —-a-w C:\WINDOWS\SYSTEM32\PERFH009.DAT
+ 2008-01-15 04:26:39 381,692 —-a-w C:\WINDOWS\SYSTEM32\PERFH009.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"diagent"="C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" [2008-01-19 12:12 135264]
"AdaptecDirectCD"="C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" [2008-01-19 12:11 684032]
"DeviceDiscovery"="C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe" [2008-01-19 12:11 40960]
"HPDJ Taskbar Utility"="C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe" [2008-01-19 12:11 172032]
"Synchronization Manager"="C:\WINDOWS\system32\mobsync.exe" [2002-08-29 05:00 135680]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-01-19 12:11 151597]
"avgnt"="C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" [2008-01-19 12:12 262184]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [ ]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask .exe" [ ]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-01-19 12:12 267048]
"Corel Photo Downloader"="C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader .exe" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"The Intranet"="intranet.exe" []

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunServices]
"The Intranet"="intranet.exe" []

C:\Documents and Settings\Mom & Dad\Start Menu\Programs\Startup\
SpywareGuard.lnk - C:\Program Files\SpywareGuard\sgmain.exe [2003-08-29 18:05:35]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 04:44:06]
NkbMonitor.exe.lnk - C:\Program Files\Nikon\PictureProject\NkbMonitor.exe [2006-04-02 21:45:46]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegedit"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run]
"{2010146B-0A64-1033-0507-030416030001}"= "C:\Program Files\Common Files\{2010146B-0A64-1033-0507-030416030001}\Update.exe" te-110-12-0000132

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli scecli scecli

R0 avgntmgr;avgntmgr;C:\WINDOWS\System32\drivers\avgntmgr.sys [2006-12-15 16:34]
R1 avgntdd;avgntdd;C:\WINDOWS\System32\DRIVERS\avgntdd.sys [2006-12-15 16:34]
R1 ewido security suite driver;ewido security suite driver;C:\Program Files\ewido\security suite\guard.sys [2004-11-22 09:15]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\14ca49e4-f5a0-4a28-83d1-b8845ab13a03]
C:\WINDOWS\System32\rdmxcom.exe
.
Contents of the 'Scheduled Tasks' folder
"2008-01-11 16:16:04 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-19 12:28:23
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-19 12:35:37 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-19 17:35:34
ComboFix2.txt 2008-01-15 04:32:02

Logfile of HijackThis v1.99.1
Scan saved at 12:38:32 PM, on 1/19/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe
C:\WINDOWS\System32\PSIService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Documents and Settings\Mom & Dad\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://smbusiness.dellnet.com/
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [diagent] "C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" startup
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask .exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Corel Photo Downloader] "C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader .exe" -startup
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall-beta.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/oas/ActiveX/MSDcode.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab
O16 - DPF: {55027008-315F-4F45-BBC3-8BE119764741} (Slide Image Uploader Control) - http://www.slide.com/uploader/SlideImageUploader.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zonelabs.com/bin/promotion…canner37500.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {B49C4597-8721-4789-9250-315DFBD9F525} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/radio/ampx/ampx2.6.1.11_en_dl.cab
O16 - DPF: {D3D83E08-54D1-4E9D-8EAF-9F979D139294} (MaxisSimCityScapeTeleX Control) - http://simcity.ea.com/scape/teleport/Maxis…yScapeTeleX.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/d…/ITDetector.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\System32\PSIService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

little eagle

Post #6January 19, 2008, 10:00 PM UTC

Please download, remove and reinstall these programs.

C:\Program Files\AntiVir PersonalEdition Classic
C:\Program Files\Zone Labs\ZoneAlarm

—————————————–

Run this online scan from ESET

You will need to use Internet explorer for this scan!

First, accept the Terms of Use
Click: Start
When asked, allow the ActiveX control to install
Click: Start
Make sure the options:
Remove found threats, and Scan unwanted applications
are both checked!
Click: Scan

When the scan finishes, use Notepad to open the ESET report.
It will be located here C:\Program Files\EsetOnlineScanner\log.txt

Rio

Post #7January 20, 2008, 7:45 PM UTC

downloaded, removed and reinstalled programs. Not able to get ESET to run. Getting error in the initialization step when trying to download the full signature database. Is there another on-line scan available or some security setting I need to change.

little eagle

Post #8January 20, 2008, 7:58 PM UTC

Try this one HERE to run Panda's ActiveScan

* You need to use IE to run this scan
* Once you are on the Panda site click the Scan your PC button
* A new window will open…click the Check Now button
* Enter your Country
* Enter your State/Province
* Enter your e-mail address and click send
* Select either Home User or Company
* Click the big Scan Now button
* If it wants to install an ActiveX component allow it
* It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
* When download is complete, click on My Computer to start the scan
* When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location. Post the contents of the ActiveScan report

Rio

Post #9January 21, 2008, 4:47 AM UTC

Panda scan starts, but then gets hung up. Tried a few times with same result. Did get Avira AntiVir scan to give me a log. Refer to the attached and let me know if this helps. FYI If you send a reply, I won't be able to get back until Thursday this week. AntiVir PersonalEdition Classic Report file date: Sunday, January 20, 2008 19:23 Scanning for 1059592 virus strains and unwanted programs. Licensed to: Avira AntiVir PersonalEdition Classic Serial number: 0000149996-ADJIE-0001 Platform: Windows XP Windows version: (Service Pack 1) [5.1.2600] Username: SYSTEM Computer name: HOME Version information: BUILD.DAT : 270 15603 Bytes 9/19/2007 13:32:00 AVSCAN.EXE : 7.0.6.1 290856 Bytes 8/23/2007 19:16:29 AVSCAN.DLL : 7.0.6.0 49192 Bytes 8/16/2007 18:23:51 LUKE.DLL : 7.0.5.3 147496 Bytes 8/14/2007 21:32:47 LUKERES.DLL : 7.0.6.1 10280 Bytes 8/21/2007 18:35:20 ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 7/18/2007 19:28:37 ANTIVIR1.VDF : 7.0.1.95 3367424 Bytes 12/14/2007 19:28:37 ANTIVIR2.VDF : 7.0.2.0 948736 Bytes 1/15/2008 19:28:37 ANTIVIR3.VDF : 7.0.2.22 257536 Bytes 1/20/2008 19:28:37 AVEWIN32.DLL : 7.6.0.48 3080704 Bytes 1/20/2008 19:28:41 AVWINLL.DLL : 1.0.0.7 14376 Bytes 2/26/2007 16:36:26 AVPREF.DLL : 7.0.2.2 25640 Bytes 7/18/2007 13:39:17 AVREP.DLL : 7.0.0.1 155688 Bytes 4/16/2007 19:16:24 AVPACK32.DLL : 7.6.0.3 360488 Bytes 1/20/2008 19:28:42 AVREG.DLL : 7.0.1.6 30760 Bytes 7/18/2007 13:17:06 AVARKT.DLL : 1.0.0.20 278568 Bytes 8/28/2007 18:26:33 AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 7/18/2007 13:10:18 NETNT.DLL : 7.0.0.0 7720 Bytes 3/8/2007 17:09:42 RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 8/7/2007 18:38:13 RCTEXT.DLL : 7.0.62.0 86056 Bytes 8/21/2007 18:50:37 SQLITE3.DLL : 3.3.17.1 339968 Bytes 7/23/2007 15:37:21 Configuration settings for the scan: Jobname……………………..: Complete system scan Configuration file……………: c:\program files\avira\antivir personaledition classic\sysscan.avp Logging……………………..: low Primary action……………….: interactive Secondary action……………..: ignore Scan master boot sector……….: off Scan boot sector……………..: on Boot sectors…………………: C:, Scan memory………………….: on Process scan…………………: on Scan registry………………..: on Search for rootkits…………..: off Scan all files……………….: Intelligent file selection Scan archives………………..: on Recursion depth………………: 20 Smart extensions……………..: on Macro heuristic………………: on File heuristic……………….: medium Start of the scan: Sunday, January 20, 2008 19:23 The scan of running processes will be started Scan process 'avscan.exe' - '1' Module(s) have been scanned Scan process 'avcenter.exe' - '1' Module(s) have been scanned Scan process 'iPodService.exe' - '1' Module(s) have been scanned Scan process 'wanmpsvc.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'PSIService.exe' - '1' Module(s) have been scanned Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned Scan process 'sched.exe' - '1' Module(s) have been scanned Scan process 'alg.exe' - '1' Module(s) have been scanned Scan process 'diagent.exe' - '1' Module(s) have been scanned Scan process 'sgbhp.exe' - '1' Module(s) have been scanned Scan process 'avguard.exe' - '1' Module(s) have been scanned Scan process 'spoolsv.exe' - '1' Module(s) have been scanned Scan process 'sgmain.exe' - '1' Module(s) have been scanned Scan process 'NkbMonitor.exe' - '1' Module(s) have been scanned Scan process 'reader_sl.exe' - '1' Module(s) have been scanned Scan process 'avgnt.exe' - '1' Module(s) have been scanned Scan process 'zlclient.exe' - '0' Module(s) have been scanned Scan process 'iTunesHelper.exe' - '1' Module(s) have been scanned Scan process 'realsched.exe' - '1' Module(s) have been scanned Scan process 'hpotdd01.exe' - '1' Module(s) have been scanned Scan process 'DirectCD.exe' - '1' Module(s) have been scanned Scan process 'explorer.exe' - '1' Module(s) have been scanned Scan process 'vsmon.exe' - '0' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'lsass.exe' - '1' Module(s) have been scanned Scan process 'services.exe' - '1' Module(s) have been scanned Scan process 'winlogon.exe' - '1' Module(s) have been scanned Scan process 'csrss.exe' - '1' Module(s) have been scanned Scan process 'smss.exe' - '1' Module(s) have been scanned 31 processes with 31 modules were scanned Start scanning boot sectors: Boot sector 'C:\' [NOTE] No virus was found! Starting to scan the registry. The registry was scanned ( '17' files ). Starting the file scan: Begin scan in 'C:\' C:\hiberfil.sys [WARNING] The file could not be opened! C:\pagefile.sys [WARNING] The file could not be opened! C:\syswvqd.exe [DETECTION] Is the Trojan horse TR/Drop.Agent.bgh.3 [INFO] The file was moved to '4806e667.qua'! C:\Program Files\RcvSystem\httpdchk.dll [DETECTION] Contains suspicious code HEUR/Malware [INFO] The file was moved to '4807f8d0.qua'! C:\QooBox\Quarantine\catchme2008-01-14_232357.64.zip [0] Archive type: ZIP –> iifcawv.dll [DETECTION] Is the Trojan horse TR/Vundo.DTY.2 [INFO] The file was moved to '4807fb68.qua'! C:\QooBox\Quarantine\C\Program Files\Zone Labs\ZoneAlarm\zlclient.exe.vir [DETECTION] Is the Trojan horse TR/Trash.Gen [INFO] The file was moved to '47f6fb7d.qua'! C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\000080.exe.vir [DETECTION] Contains detection pattern of the dropper DR/Agent.VV.2 [INFO] The file was moved to '47c3fb44.qua'! C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\000090.exe.vir [DETECTION] Is the Trojan horse TR/Vundo.DTY.1 [INFO] The file was moved to '47c3fb46.qua'! C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\atvgegpu.dll.vir [DETECTION] Is the Trojan horse TR/Vundo.DUP [INFO] The file was moved to '4809fb8c.qua'! C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\avoevgxv.dll.vir [DETECTION] Is the Trojan horse TR/Vundo.dvc.5 [INFO] The file was moved to '4802fb91.qua'! C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\awtst.dll.vir [DETECTION] Is the Trojan horse TR/Trash.Gen [INFO] The file was moved to '4807fb94.qua'! C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\ewjrevgq.dll.vir [DETECTION] Is the Trojan horse TR/Vundo.dvc.4 [INFO] The file was moved to '47fdfb96.qua'! C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\fmeqmqdk.dll.vir [DETECTION] Is the Trojan horse TR/Vundo.Gen [INFO] The file was moved to '47f8fb8f.qua'! C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\gewdnuyw.dll.vir [DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen [INFO] The file was moved to '480afb89.qua'! C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\iifcawv.dll.vir [DETECTION] Is the Trojan horse TR/Trash.Gen [INFO] The file was moved to '47f9fb8e.qua'! C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\khkcqnpw.dll.vir [DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen [INFO] The file was moved to '47fefb8f.qua'! C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\ksjhscbg.dll.vir [DETECTION] Is the Trojan horse TR/Vundo.DUP [INFO] The file was moved to '47fdfb9c.qua'! C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\ltrwqtyo.dll.vir [DETECTION] Is the Trojan horse TR/Vundo.Gen [INFO] The file was moved to '4805fba0.qua'! C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\lxqnayjs.dll.vir [DETECTION] Is the Trojan horse TR/Vundo.DUP [INFO] The file was moved to '4804fbab.qua'! C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\opbnljtj.dll.vir [DETECTION] Is the Trojan horse TR/Vundo.Gen [INFO] The file was moved to '47f5fba4.qua'! C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\qjrtjqqs.dll.vir [DETECTION] Is the Trojan horse TR/Vundo.Gen [INFO] The file was moved to '4805fba1.qua'! C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\soidirtl.dll.vir [DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen [INFO] The file was moved to '47fcfba8.qua'! C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\tqalbwxb.dll.vir [DETECTION] Is the Trojan horse TR/Vundo.dvc.4 [INFO] The file was moved to '47f4fbac.qua'! C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\vyuthxyf.dll.vir [DETECTION] Is the Trojan horse TR/Vundo.dvc.5 [INFO] The file was moved to '4808fbb6.qua'! C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\yaxklbps.dll.vir [DETECTION] Is the Trojan horse TR/Vundo.DUP [INFO] The file was moved to '480bfba1.qua'! C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP719\A0327250.exe [DETECTION] Is the Trojan horse TR/Dldr.Small.fzl.2 [INFO] The file was moved to '47c6fcd4.qua'! C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP727\A0330021.exe [DETECTION] Contains detection pattern of the dropper DR/Agent.VV.2 [INFO] The file was moved to '47c6fd04.qua'! C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP727\A0330022.exe [DETECTION] Is the Trojan horse TR/Vundo.DTY.1 [INFO] The file was moved to '47c6fd06.qua'! C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP727\A0330027.dll [DETECTION] Is the Trojan horse TR/Vundo.DUP [INFO] The file was moved to '47c6fd08.qua'! C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP727\A0330028.dll [DETECTION] Is the Trojan horse TR/Vundo.dvc.5 [INFO] The file was moved to '47c6fd0a.qua'! C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP727\A0330029.dll [DETECTION] Is the Trojan horse TR/Vundo.dvc.4 [INFO] The file was moved to '47c6fd0c.qua'! C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP727\A0330030.dll [DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen [INFO] The file was moved to '47c6fd0e.qua'! C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP727\A0330031.dll [DETECTION] Is the Trojan horse TR/Vundo.DUP [INFO] The file was moved to '47c6fd10.qua'! C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP727\A0330032.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [INFO] The file was moved to '47c6fd12.qua'! C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP727\A0330033.dll [DETECTION] Is the Trojan horse TR/Vundo.DUP [INFO] The file was moved to '47c6fd14.qua'! C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP727\A0330034.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [INFO] The file was moved to '47c6fd15.qua'! C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP727\A0330035.dll [DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen [INFO] The file was moved to '47c6fd17.qua'! C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP727\A0330036.dll [DETECTION] Is the Trojan horse TR/Vundo.dvc.4 [INFO] The file was moved to '47c6fd18.qua'! C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP727\A0330037.dll [DETECTION] Is the Trojan horse TR/Vundo.dvc.5 [INFO] The file was moved to '47c6fd1a.qua'! C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP727\A0330038.dll [DETECTION] Is the Trojan horse TR/Vundo.DUP [INFO] The file was moved to '47c6fd1c.qua'! C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP727\A0330059.dll [DETECTION] Is the Trojan horse TR/Vundo.DTY.2 [INFO] The file was moved to '47c6fd1e.qua'! C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP727\A0331123.dll [DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen [INFO] The file was moved to '47c6fd24.qua'! C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP729\A0331187.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [INFO] The file was moved to '47c6fd2a.qua'! C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP729\A0331188.dll [DETECTION] Is the Trojan horse TR/Dldr.ConHook.Gen [INFO] The file was moved to '47c6fd2c.qua'! C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP729\A0331189.dll [DETECTION] Is the Trojan horse TR/Vundo.Gen [INFO] The file was moved to '47c6fd2d.qua'! C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP729\A0331224.exe [DETECTION] Is the Trojan horse TR/Drop.Softomat.AN [INFO] The file was moved to '47c6fd39.qua'! C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP733\A0333012.dll [DETECTION] Contains detection pattern of the Windows virus W95/Blumblebee.1738 [INFO] The file was moved to '47c6fd86.qua'! C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP733\A0333965.exe [DETECTION] Is the Trojan horse TR/Drop.Agent.bgh.3 [INFO] The file was moved to '46a13237.qua'! C:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP733\A0333969.dll [DETECTION] Contains suspicious code HEUR/Malware [INFO] The file was moved to '47c6fd87.qua'! C:\WINDOWS\SYSTEM32\000050.exe [DETECTION] Contains detection pattern of the dropper DR/Dldr.PurityScan.EG.82 [INFO] The file was moved to '47c3ffad.qua'! End of the scan: Sunday, January 20, 2008 21:15 Used time: 1:52:32 min The scan has been done completely. 10055 Scanning directories 393354 Files were scanned 46 viruses and/or unwanted programs were found 2 Files were classified as suspicious: 0 files were deleted 0 files were repaired 48 files were moved to quarantine 0 files were renamed 2 Files cannot be scanned 393308 Files not concerned 3436 Archives were scanned 2 Warnings 4 Notes

little eagle

Post #10January 21, 2008, 11:52 AM UTC

FYI If you send a reply, I won't be able to get back until Thursday this week.

Run combofix again please.

Rio

Post #11January 25, 2008, 2:08 AM UTC

Re ran Combofix. Log attached.

ComboFix 08-01-15.3 - Mom & Dad 2008-01-24 20:52:05.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.1.1252.1.1033.18.335 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2007-12-25 to 2008-01-25 )))))))))))))))))))))))))))))))
.

2008-01-20 22:10 . 2008-01-20 22:10 1,632,768 –a—— C:\WINDOWS\SYSTEM32\22C.tmp
2008-01-20 18:47 . 2007-06-08 09:44 8,576 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\RkPavProc.sys
2008-01-20 16:47 . 2008-01-20 22:10 30,590 –a—— C:\WINDOWS\SYSTEM32\pavas.ico
2008-01-20 16:47 . 2008-01-20 22:10 2,550 –a—— C:\WINDOWS\SYSTEM32\Uninstall.ico
2008-01-20 16:47 . 2008-01-20 22:10 1,406 –a—— C:\WINDOWS\SYSTEM32\Help.ico
2008-01-20 14:39 . 2008-01-20 14:39 d——– C:\nup
2008-01-20 14:38 . 2008-01-20 14:38 d——– C:\Program Files\EsetOnlineScanner
2008-01-20 14:23 . 2008-01-20 14:23 d——– C:\Program Files\Avira
2008-01-20 14:13 . 2008-01-20 14:23 d——– C:\Documents and Settings\All Users\Application Data\Avira
2008-01-20 13:59 . 2007-11-14 16:05 75,248 –a—— C:\WINDOWS\zllsputility.exe
2008-01-20 13:58 . 2007-11-14 16:05 1,086,952 –a—— C:\WINDOWS\SYSTEM32\zpeng24.dll
2008-01-20 13:58 . 2008-01-24 21:00 353,366 –a—— C:\WINDOWS\SYSTEM32\vsconfig.xml
2008-01-20 13:42 . 2008-01-20 13:42 d——– C:\Program Files\ZoneAlarmSB
2008-01-14 23:04 . 2000-08-31 08:00 51,200 –a—— C:\WINDOWS\NirCmd.exe
2008-01-09 20:00 . 2008-01-20 20:41 d——– C:\Program Files\RcvSystem
2007-12-30 20:26 . 2008-01-20 22:44 d——– C:\Program Files\iTunes
2007-12-30 20:26 . 2007-12-30 20:26 d——– C:\Program Files\iPod
2007-12-30 15:38 . 2008-01-19 12:25 d——– C:\Program Files\QuickTime
2007-12-30 15:36 . 2007-12-30 15:36 d——– C:\Program Files\Apple Software Update
2007-12-30 15:36 . 2007-12-30 15:36 d——– C:\Documents and Settings\All Users\Application Data\Apple
2007-12-25 20:10 . 2007-03-12 16:42 3,495,784 –a—— C:\WINDOWS\SYSTEM32\d3dx9_33.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-21 04:12 ——— d—–w C:\Program Files\SpywareGuard
2008-01-21 00:18 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-01-20 19:29 ——— d—–w C:\Program Files\SpywareBlaster
2008-01-20 18:37 ——— d—–w C:\Program Files\SRN Micro
2008-01-04 12:33 ——— d—–w C:\Program Files\WebHost
2007-12-28 02:55 ——— d—–w C:\Program Files\EA GAMES
2007-12-26 01:03 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-12-26 01:03 ——— d—–w C:\Program Files\Nancy Drew
2007-12-25 02:24 ——— d–h–r C:\Documents and Settings\Mom & Dad\Application Data\SecuROM
2007-12-15 23:12 ——— d—–w C:\Documents and Settings\Mom & Dad\Application Data\Corel
2007-12-15 18:28 ——— d—–w C:\Documents and Settings\All Users\Application Data\Corel
2007-12-15 18:25 ——— d—–w C:\Program Files\Common Files\Corel
2007-12-15 18:23 ——— d—–w C:\Program Files\Corel
2006-05-27 13:55 42,649 —-a-w C:\WINDOWS\Internet Logs\zlclient_2nd_2006_05_27_09_30_28_small.dmp.zip
2005-02-15 00:57 63,064 —-a-w C:\Documents and Settings\Mom & Dad\Application Data\GDIPFONTCACHEV1.DAT
2004-07-18 05:54 460,728 —-a-w C:\WINDOWS\Fonts\SET675.tmp
2004-07-18 05:54 460,728 —-a-w C:\WINDOWS\Fonts\SET5B1.tmp
2004-07-18 05:54 460,728 —-a-w C:\WINDOWS\Fonts\SET4C4.tmp
2004-07-18 05:54 383,140 —-a-w C:\WINDOWS\Fonts\SET674.tmp
2004-07-18 05:54 383,140 —-a-w C:\WINDOWS\Fonts\SET5B0.tmp
2004-07-18 05:54 383,140 —-a-w C:\WINDOWS\Fonts\SET4C3.tmp
2004-07-18 05:54 355,436 —-a-w C:\WINDOWS\Fonts\SET673.tmp
2004-07-18 05:54 355,436 —-a-w C:\WINDOWS\Fonts\SET5AF.tmp
2004-07-18 05:54 355,436 —-a-w C:\WINDOWS\Fonts\SET4C2.tmp
2004-07-17 18:39 409,280 —-a-w C:\WINDOWS\Fonts\SET672.tmp
2004-07-17 18:39 409,280 —-a-w C:\WINDOWS\Fonts\SET5AE.tmp
2004-07-17 18:39 409,280 —-a-w C:\WINDOWS\Fonts\SET4C1.tmp
2004-07-17 18:39 398,372 —-a-w C:\WINDOWS\Fonts\SET671.tmp
2004-07-17 18:39 398,372 —-a-w C:\WINDOWS\Fonts\SET5AD.tmp
2004-07-17 18:39 398,372 —-a-w C:\WINDOWS\Fonts\SET4C0.tmp
2004-07-17 18:39 367,112 —-a-w C:\WINDOWS\Fonts\SET678.tmp
2004-07-17 18:39 367,112 —-a-w C:\WINDOWS\Fonts\SET5B4.tmp
2004-07-17 18:39 367,112 —-a-w C:\WINDOWS\Fonts\SET4C7.tmp
2004-07-17 18:39 352,224 —-a-w C:\WINDOWS\Fonts\SET677.tmp
2004-07-17 18:39 352,224 —-a-w C:\WINDOWS\Fonts\SET5B3.tmp
2004-07-17 18:39 352,224 —-a-w C:\WINDOWS\Fonts\SET4C6.tmp
2004-07-17 18:39 127,596 —-a-w C:\WINDOWS\Fonts\SET676.tmp
2004-07-17 18:39 127,596 —-a-w C:\WINDOWS\Fonts\SET5B2.tmp
2004-07-17 18:39 127,596 —-a-w C:\WINDOWS\Fonts\SET4C5.tmp
.

—-a-w		   919,016 2008-01-19 17:12:07  C:\Program Files\Zone Labs\ZoneAlarm\zlclient .exe

((((((((((((((((((((((((((((( snapshot@2008-01-14_23.31.37.25 )))))))))))))))))))))))))))))))))))))))))
.
- 2005-02-08 15:52:16 110,592 —-a-w C:\WINDOWS\Downloaded Program Files\asinst.dll
+ 2006-08-24 13:28:54 141,424 —-a-w C:\WINDOWS\Downloaded Program Files\asinst.dll
+ 2007-11-20 21:04:32 1,523,536 —-a-w C:\WINDOWS\Downloaded Program Files\CONFLICT.1\FP_AX_CAB_INSTALLER.exe
+ 2007-11-20 21:04:32 1,523,536 —-a-w C:\WINDOWS\Downloaded Program Files\CONFLICT.2\FP_AX_CAB_INSTALLER.exe
+ 2007-11-20 21:04:32 1,523,536 —-a-w C:\WINDOWS\Downloaded Program Files\CONFLICT.3\FP_AX_CAB_INSTALLER.exe
+ 2007-11-20 21:04:32 1,523,536 —-a-w C:\WINDOWS\Downloaded Program Files\CONFLICT.4\FP_AX_CAB_INSTALLER.exe
+ 2007-11-20 21:04:32 1,523,536 —-a-w C:\WINDOWS\Downloaded Program Files\CONFLICT.5\FP_AX_CAB_INSTALLER.exe
+ 2007-11-20 21:04:32 1,523,536 —-a-w C:\WINDOWS\Downloaded Program Files\CONFLICT.6\FP_AX_CAB_INSTALLER.exe
- 2008-01-15 04:05:00 479,232 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT
+ 2008-01-19 17:16:11 479,232 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT
- 2008-01-15 04:05:00 8,192 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
+ 2008-01-19 17:16:11 8,192 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
- 2008-01-15 04:05:00 5,554,176 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\NTUSER.DAT
+ 2008-01-19 17:16:11 5,554,176 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\NTUSER.DAT
- 2008-01-15 04:05:00 49,152 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
+ 2008-01-19 17:16:11 49,152 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
- 2008-01-15 04:05:00 479,232 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\NTUSER.DAT
+ 2008-01-19 17:16:11 479,232 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\NTUSER.DAT
- 2008-01-15 04:05:00 8,192 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
+ 2008-01-19 17:16:11 8,192 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
- 2005-02-11 18:15:14 98,304 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\as.dll
+ 2007-03-29 14:20:50 110,592 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\as.dll
- 2005-02-08 15:46:20 233,472 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\ascontrol.dll
+ 2006-10-05 21:15:26 233,472 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\ascontrol.dll
- 1998-10-08 03:16:00 96,256 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\asmdat.dll
+ 2005-06-03 19:03:18 96,256 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\asmdat.dll
- 2003-08-01 15:00:16 36,864 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\certdll.dll
+ 2003-08-01 16:00:16 36,864 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\certdll.dll
- 2004-10-26 23:14:40 192,512 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\instlsp.dll
+ 2005-05-20 18:42:44 86,016 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\instlsp.dll
+ 2007-11-12 14:46:18 26,112 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\JID.dll
+ 2006-02-16 23:20:20 4,608 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\memvfile.dll
+ 2005-10-25 23:08:32 348,160 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\msvcr71.dll
+ 2007-11-26 16:10:36 61,440 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\NanoWrapper.dll
- 2002-10-04 23:48:06 131,072 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\pavaleas.dll
+ 2004-05-04 20:01:02 139,264 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\pavaleas.dll
- 2004-11-12 20:27:58 40,960 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\pavdr.exe
+ 2006-07-14 18:04:10 45,056 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\pavdr.exe
- 2004-09-21 20:09:32 172,092 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\pavexcom.dll
+ 2006-04-10 15:50:02 159,832 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\pavexcom.dll
+ 2006-02-14 18:05:38 94,208 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\pavinas.dll
- 2004-09-22 20:11:48 180,224 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\pavoe.dll
+ 2006-02-16 23:35:38 180,224 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\pavoe.dll
- 2005-02-09 20:36:56 106,496 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\pavpz.dll
+ 2006-10-05 21:15:38 122,880 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\pavpz.dll
+ 2007-06-04 16:31:52 57,344 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\pavsddl.dll
- 2004-10-06 14:38:20 6,178 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\pfdnnt.exe
+ 2006-06-30 19:13:38 8,704 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\pfdnnt.exe
- 2004-02-04 18:08:42 49,152 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\port32.dll
+ 2004-02-04 19:08:42 49,152 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\port32.dll
+ 2007-10-30 15:04:14 36,864 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\Prescan.dll
+ 2006-08-01 18:23:10 69,632 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\pscpu.dll
+ 2007-11-21 15:00:06 376,832 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskahk.dll
+ 2007-10-31 18:05:06 32,768 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\PSKAHKPRESCAN.dll
- 2004-11-12 15:18:38 5,632 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskalloc.dll
+ 2006-08-17 16:38:14 10,752 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskalloc.dll
+ 2006-09-04 16:49:54 61,440 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskas.dll
- 2004-12-24 17:23:00 364,571 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskcmp.dll
+ 2007-03-26 19:25:34 417,792 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskcmp.dll
+ 2006-08-09 15:42:24 90,112 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskfss.dll
+ 2006-07-19 15:55:58 208,896 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskhtml.dll
+ 2006-01-20 21:57:00 9,728 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskmas.dll
+ 2006-05-17 14:50:12 14,336 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskmdfs.dll
- 2004-11-03 17:46:52 29,696 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskpack.dll
+ 2006-08-16 15:58:12 33,280 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskpack.dll
+ 2006-06-30 19:42:36 266,240 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskscs.dll
+ 2006-08-17 19:33:14 62,976 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskutil.dll
- 2004-11-03 17:42:22 10,752 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskvfile.dll
+ 2006-08-08 18:13:10 13,312 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskvfile.dll
+ 2006-08-18 13:53:08 69,632 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskvfs.dll
- 2005-02-09 14:41:10 232,960 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskvm.dll
+ 2006-08-18 13:49:50 167,936 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\pskvm.dll
+ 2007-10-18 14:30:16 105,472 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\psnahk.dll
+ 2007-11-23 19:29:08 10,752 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\psndsk.dll
+ 2007-10-18 14:30:38 42,496 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\psnflg.dll
+ 2007-10-30 16:19:22 98,304 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\psnglknt.dll
+ 2007-08-22 13:52:00 20,272 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\psnhsh.dll
+ 2007-11-12 20:49:34 11,776 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\psnjidsign.dll
+ 2007-08-22 13:52:04 76,080 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\psnkrnl.dll
+ 2007-08-22 13:52:06 21,296 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\psnmem.dll
+ 2007-10-04 20:26:28 28,672 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\PsnPen.dll
+ 2007-10-23 16:40:10 86,016 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\psntuc.dll
+ 2007-05-24 16:27:36 27,136 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\PSNXprs.dll
- 2005-02-11 15:44:02 237,625 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\psscan.dll
+ 2007-04-18 22:16:04 353,840 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\psscan.dll
+ 2007-01-22 19:42:48 35,328 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\rawvfile.dll
+ 2007-06-08 14:44:36 8,576 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\RKPavProc.sys
+ 2007-06-05 15:56:40 44,928 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\sdthook.sys
- 1997-09-18 10:12:32 9,488 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\sporder.dll
+ 1997-09-18 11:12:32 9,488 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\sporder.dll
- 2004-09-21 21:10:04 24,576 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\tcpvfile.dll
+ 2006-02-28 22:23:40 69,632 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\tcpvfile.dll
+ 2007-09-17 14:14:08 126,976 —-a-w C:\WINDOWS\SYSTEM32\ActiveScan\Tucan.dll
+ 2006-08-02 17:39:06 73,728 —-a-w C:\WINDOWS\SYSTEM32\asuninst.exe
- 2008-01-11 20:56:25 16,384 —-a-w C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\INDEX.DAT
+ 2008-01-25 02:00:42 16,384 —-a-w C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\INDEX.DAT
- 2008-01-11 20:56:25 32,768 —-a-w C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\History\History.IE5\INDEX.DAT
+ 2008-01-25 02:00:42 32,768 —-a-w C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\History\History.IE5\INDEX.DAT
- 2008-01-11 20:56:25 81,920 —-a-w C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\INDEX.DAT
+ 2008-01-25 02:00:42 81,920 —-a-w C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\INDEX.DAT
- 2006-12-15 21:34:01 34,304 —-a-w C:\WINDOWS\SYSTEM32\DRIVERS\avgntdd.sys
+ 2007-08-09 18:04:11 40,768 —-a-w C:\WINDOWS\SYSTEM32\DRIVERS\avgntdd.sys
- 2006-12-15 21:34:01 14,848 —-a-w C:\WINDOWS\SYSTEM32\DRIVERS\avgntmgr.sys
+ 2007-07-18 19:22:19 21,312 —-a-w C:\WINDOWS\SYSTEM32\DRIVERS\avgntmgr.sys
+ 2008-01-20 19:28:42 61,632 —-a-w C:\WINDOWS\SYSTEM32\DRIVERS\avipbb.sys
+ 2007-03-01 15:34:36 28,352 —-a-w C:\WINDOWS\SYSTEM32\DRIVERS\ssmdrv.sys
- 2006-07-09 17:41:58 796,584 —-a-w C:\WINDOWS\SYSTEM32\libeay32_0.9.6l.dll
+ 2007-11-14 21:04:46 796,048 —-a-w C:\WINDOWS\SYSTEM32\libeay32_0.9.6l.dll
+ 2007-07-27 20:49:02 196,683 —-a-w C:\WINDOWS\SYSTEM32\lnod32apiA.dll
+ 2007-07-27 20:49:02 225,355 —-a-w C:\WINDOWS\SYSTEM32\lnod32apiW.dll
+ 2005-12-06 01:25:22 139,264 —-a-w C:\WINDOWS\SYSTEM32\lnod32umc.dll
+ 2005-12-05 18:37:10 106,496 —-a-w C:\WINDOWS\SYSTEM32\lnod32upd.dll
+ 2007-08-02 23:11:28 253,952 —-a-w C:\WINDOWS\SYSTEM32\OnlineScannerDLLA.dll
+ 2007-08-02 23:11:14 241,664 —-a-w C:\WINDOWS\SYSTEM32\OnlineScannerDLLW.dll
+ 2007-08-08 21:30:12 19,456 —-a-w C:\WINDOWS\SYSTEM32\OnlineScannerLang.dll
+ 2007-06-13 16:10:34 77,824 —-a-w C:\WINDOWS\SYSTEM32\OnlineScannerUninstaller.exe
- 2007-10-29 21:53:52 53,436 —-a-w C:\WINDOWS\SYSTEM32\PERFC009.DAT
+ 2008-01-15 04:26:39 53,436 —-a-w C:\WINDOWS\SYSTEM32\PERFC009.DAT
- 2007-10-29 21:53:52 381,692 —-a-w C:\WINDOWS\SYSTEM32\PERFH009.DAT
+ 2008-01-15 04:26:39 381,692 —-a-w C:\WINDOWS\SYSTEM32\PERFH009.DAT
- 2008-01-10 01:27:02 507,392 —-a-w C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\hpztsb08.exe
+ 2008-01-19 17:11:53 172,032 —-a-w C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\hpztsb08.exe
- 2007-09-06 20:14:04 83,432 —-a-w C:\WINDOWS\SYSTEM32\vsdata.dll
+ 2007-11-14 21:04:52 83,432 —-a-w C:\WINDOWS\SYSTEM32\vsdata.dll
- 2007-09-06 20:14:28 395,080 —-a-w C:\WINDOWS\SYSTEM32\vsdatant.sys
+ 2007-11-14 21:05:16 394,952 —-a-w C:\WINDOWS\SYSTEM32\vsdatant.sys
- 2007-09-06 20:14:04 157,160 —-a-w C:\WINDOWS\SYSTEM32\vsinit.dll
+ 2007-11-14 21:04:52 157,160 —-a-w C:\WINDOWS\SYSTEM32\vsinit.dll
- 2007-09-06 20:14:04 103,912 —-a-w C:\WINDOWS\SYSTEM32\vsmonapi.dll
+ 2007-11-14 21:04:52 103,912 —-a-w C:\WINDOWS\SYSTEM32\vsmonapi.dll
- 2007-09-06 20:14:04 275,944 —-a-w C:\WINDOWS\SYSTEM32\vspubapi.dll
+ 2007-11-14 21:04:52 275,944 —-a-w C:\WINDOWS\SYSTEM32\vspubapi.dll
- 2007-09-06 20:14:04 71,144 —-a-w C:\WINDOWS\SYSTEM32\vsregexp.dll
+ 2007-11-14 21:04:52 71,144 —-a-w C:\WINDOWS\SYSTEM32\vsregexp.dll
- 2007-09-06 20:14:06 472,552 —-a-w C:\WINDOWS\SYSTEM32\vsutil.dll
+ 2007-11-14 21:04:54 472,552 —-a-w C:\WINDOWS\SYSTEM32\vsutil.dll
- 2007-09-06 20:14:06 46,568 —-a-w C:\WINDOWS\SYSTEM32\vswmi.dll
+ 2007-11-14 21:04:54 46,568 —-a-w C:\WINDOWS\SYSTEM32\vswmi.dll
- 2007-09-06 20:14:06 99,816 —-a-w C:\WINDOWS\SYSTEM32\vsxml.dll
+ 2007-11-14 21:04:54 99,816 —-a-w C:\WINDOWS\SYSTEM32\vsxml.dll
- 2007-09-06 20:14:06 83,432 —-a-w C:\WINDOWS\SYSTEM32\zlcomm.dll
+ 2007-11-14 21:04:56 83,432 —-a-w C:\WINDOWS\SYSTEM32\zlcomm.dll
- 2007-09-06 20:14:08 71,144 —-a-w C:\WINDOWS\SYSTEM32\zlcommdb.dll
+ 2007-11-14 21:04:56 71,144 —-a-w C:\WINDOWS\SYSTEM32\zlcommdb.dll
- 2007-09-30 15:34:45 4,212 —ha-w C:\WINDOWS\SYSTEM32\zllictbl.dat
+ 2008-01-20 19:00:45 4,212 —h–w C:\WINDOWS\SYSTEM32\zllictbl.dat
- 2007-09-06 20:13:56 370,208 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\av.dll
+ 2007-11-14 21:04:44 370,208 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\av.dll
- 2007-05-31 04:03:30 65,248 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\bases\aphish.dat
+ 2007-05-31 05:03:30 65,248 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\bases\aphish.dat
- 2006-06-30 18:47:36 21,568 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\bases\avcmhk4.dll
+ 2006-06-30 19:47:36 21,568 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\bases\avcmhk4.dll
- 2007-05-31 04:03:16 77,824 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\CKAHComm.dll
+ 2007-05-31 05:03:16 77,824 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\CKAHComm.dll
- 2007-05-31 04:03:16 110,592 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\CKAHrule.dll
+ 2007-05-31 05:03:16 110,592 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\CKAHrule.dll
- 2007-05-31 04:03:16 331,776 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\CKAHUM.dll
+ 2007-05-31 05:03:16 331,776 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\CKAHUM.dll
- 2007-05-31 04:03:16 38,400 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\FSSync.dll
+ 2007-05-31 05:03:16 38,400 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\FSSync.dll
- 2007-07-19 19:10:32 110,360 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\instdrivers\w2kxp32\kl1.sys
+ 2007-07-19 20:10:32 110,360 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\instdrivers\w2kxp32\kl1.sys
- 2007-07-19 19:10:32 186,128 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\instdrivers\w2kxp32\klif.sys
+ 2007-07-19 20:10:32 186,128 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\instdrivers\w2kxp32\klif.sys
- 2007-05-31 04:03:48 110,360 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\instdrivers\x32\kl1.sys
+ 2007-05-31 05:03:48 110,360 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\instdrivers\x32\kl1.sys
- 2007-07-19 19:10:28 127,768 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\instdrivers\x32\klif.sys
+ 2007-07-19 20:10:28 127,768 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\instdrivers\x32\klif.sys
- 2007-05-31 04:03:50 45,056 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\instdrivers\x32\regcat.exe
+ 2007-05-31 05:03:50 45,056 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\instdrivers\x32\regcat.exe
- 2006-09-20 03:12:14 208,960 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\inv.dll
+ 2006-09-20 04:12:14 208,960 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\inv.dll
- 2007-08-24 23:31:48 274,432 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\kave.dll
+ 2007-09-12 02:09:16 274,432 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\kave.dll
- 2007-07-19 19:10:32 186,128 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\klif_32.sys
+ 2007-07-19 20:10:32 186,128 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\klif_32.sys
- 2006-12-19 22:13:52 1,093,632 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\libeay32.dll
+ 2006-12-19 23:13:52 1,093,632 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\libeay32.dll
- 2007-05-31 04:03:20 548,864 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\msvcp80.dll
+ 2007-05-31 05:03:20 548,864 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\msvcp80.dll
- 2007-05-31 04:03:20 626,688 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\msvcr80.dll
+ 2007-05-31 05:03:20 626,688 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\msvcr80.dll
- 2007-05-31 04:03:18 184,320 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\prloader.dll
+ 2007-05-31 05:03:18 184,320 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\prloader.dll
- 2007-05-31 04:03:22 90,112 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\prremote.dll
+ 2007-05-31 05:03:22 90,112 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\prremote.dll
- 2007-08-24 23:31:48 135,168 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\ScanningProcess.exe
+ 2007-09-12 02:09:16 135,168 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\ScanningProcess.exe
- 2006-12-19 22:13:52 200,704 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\ssleay32.dll
+ 2006-12-19 23:13:52 200,704 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\ssleay32.dll
- 2007-09-06 20:13:56 99,816 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\camupd.dll
+ 2007-11-14 21:04:44 99,816 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\camupd.dll
- 2004-01-30 16:35:08 813,568 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\dbghelp.dll
+ 2004-01-30 17:35:08 813,568 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\dbghelp.dll
- 2007-09-06 20:13:58 128,480 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\fbl.dll
+ 2007-11-14 21:04:46 128,480 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\fbl.dll
- 2007-09-06 20:13:58 38,376 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\featuremap.dll
+ 2007-11-14 21:04:46 38,376 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\featuremap.dll
- 2007-09-06 20:13:58 321,016 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\imsecure.dll
+ 2007-11-14 21:04:46 321,016 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\imsecure.dll
- 2007-09-06 20:14:30 288,144 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\lib\ConfigWizard.zip.dll
+ 2007-11-14 21:05:18 288,144 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\lib\ConfigWizard.zip.dll
- 2007-09-06 20:14:30 152,976 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\lib\licenseui.zip.dll
+ 2007-11-14 21:05:18 152,976 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\lib\licenseui.zip.dll
- 2007-09-06 20:14:30 26,000 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\lib\zlsvc.zip.dll
+ 2007-11-14 21:05:18 26,000 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\lib\zlsvc.zip.dll
- 2007-09-06 20:14:32 1,361,296 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\lib\zpy.zip.dll
+ 2007-11-14 21:05:18 1,361,296 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\lib\zpy.zip.dll
- 2007-09-06 20:14:32 71,056 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\lib\zui.zip.dll
+ 2007-11-14 21:05:20 71,056 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\lib\zui.zip.dll
- 2007-09-06 20:15:50 30,184 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\plugins\rpc_server\rpc_server.dll
+ 2007-11-14 21:06:34 30,184 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\plugins\rpc_server\rpc_server.dll
- 2007-09-06 20:15:52 30,216 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\plugins\vsmon_plugin\vsmon_plugin.dll
+ 2007-11-14 21:06:36 30,216 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\plugins\vsmon_plugin\vsmon_plugin.dll
- 2007-08-15 19:45:42 714,208 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\qrbase.dll
+ 2007-10-19 01:18:38 714,208 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\qrbase.dll
- 2007-08-15 19:45:44 787,936 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\qrsrecl.dll
+ 2007-10-19 01:18:38 787,936 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\qrsrecl.dll
- 2007-09-06 20:14:00 173,544 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\scheduler.dll
+ 2007-11-14 21:04:48 173,544 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\scheduler.dll
- 2007-01-11 15:12:08 2,432,259 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\spyware.dat
+ 2007-01-11 16:12:08 2,432,259 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\spyware.dat
- 2007-08-15 19:45:44 1,500,640 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\srescan.dll
+ 2007-10-19 01:18:40 1,500,640 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\srescan.dll
- 2007-06-11 16:44:10 50,416 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\srescan.sys
+ 2007-10-19 01:18:44 51,176 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\srescan.sys
- 2007-09-06 20:14:02 456,168 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\ssleay32.dll
+ 2007-11-14 21:04:50 456,168 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\ssleay32.dll
- 2007-09-06 20:15:52 214,528 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\streamapi\httpblocker\httpblocker.dll
+ 2007-11-14 21:06:36 214,528 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\streamapi\httpblocker\httpblocker.dll
- 2007-09-06 20:15:54 3,266,040 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\streamapi\imslsp\imslsp.dll
+ 2007-11-14 21:06:36 3,266,040 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\streamapi\imslsp\imslsp.dll
- 2006-09-05 00:59:14 503,875 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\upd_core.dll
+ 2006-09-05 01:59:14 503,875 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\upd_core.dll
- 2007-08-01 10:30:04 833,248 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\updating.dll
+ 2007-10-11 21:50:32 832,984 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\updating.dll
- 2007-09-06 20:14:18 149,032 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\updclient.exe
+ 2007-11-14 21:05:06 144,936 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\updclient.exe
- 2007-01-11 21:31:06 286,787 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\updtrsdk.dll
+ 2007-01-11 22:31:06 286,787 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\updtrsdk.dll
- 2007-09-06 20:14:04 108,008 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\vsavpro.dll
+ 2007-11-14 21:04:52 108,008 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\vsavpro.dll
- 2007-09-06 20:14:04 79,336 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\vsdb.dll
+ 2007-11-14 21:04:52 83,432 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\vsdb.dll
- 2007-09-06 20:14:18 75,304 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
+ 2007-11-14 21:05:06 75,304 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
- 2007-09-06 20:14:04 2,024,936 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\vsmondll.dll
+ 2007-11-14 21:04:52 2,029,032 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\vsmondll.dll
- 2007-09-06 20:14:06 1,345,000 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\vsruledb.dll
+ 2007-11-14 21:04:54 1,361,384 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\vsruledb.dll
- 2007-09-06 20:14:06 239,080 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\vsvault.dll
+ 2007-11-14 21:04:54 239,080 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\vsvault.dll
- 2007-01-11 15:12:08 2,432,259 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\zlasdbup.dat
+ 2007-01-11 16:12:08 2,432,259 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\zlasdbup.dat
- 2007-09-06 20:14:08 177,640 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\zlparser.dll
+ 2007-11-14 21:04:56 177,640 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\zlparser.dll
- 2007-09-06 20:14:08 79,344 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\zlquarantine.dll
+ 2007-11-14 21:04:56 79,344 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\zlquarantine.dll
- 2007-09-06 20:14:08 382,440 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\zlsre.dll
+ 2007-11-14 21:04:58 382,440 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\zlsre.dll
- 2007-09-06 20:14:08 120,296 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\zlupdate.dll
+ 2007-11-14 21:04:58 120,296 —-a-w C:\WINDOWS\SYSTEM32\ZoneLabs\zlupdate.dll
- 2003-03-25 22:53:50 11,776 —-a-w C:\WINDOWS\SYSTEM32\ZPORT4AS.dll
+ 2003-03-25 23:53:50 11,776 —-a-w C:\WINDOWS\SYSTEM32\ZPORT4AS.dll
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA}]
2008-01-20 13:42 262144 –a—— C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{8E718888-423F-11D2-876E-00A0C9082467}
{EF99BD32-C1FB-11D2-892F-0090271D4F88}
{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}

[HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}"= C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL [2008-01-20 13:42 262144]

[HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"diagent"="C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" [2008-01-19 12:12 135264]
"AdaptecDirectCD"="C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" [2008-01-19 12:11 684032]
"DeviceDiscovery"="C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe" [2008-01-19 12:11 40960]
"HPDJ Taskbar Utility"="C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe" [2008-01-19 12:11 172032]
"Synchronization Manager"="C:\WINDOWS\system32\mobsync.exe" [2002-08-29 05:00 135680]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-01-19 12:11 151597]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask .exe" [ ]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-01-19 12:12 267048]
"Corel Photo Downloader"="C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader .exe" [ ]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-11-14 16:05 919016]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-01-20 14:28 249896]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"The Intranet"="intranet.exe" []

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunServices]
"The Intranet"="intranet.exe" []

C:\Documents and Settings\Mom & Dad\Start Menu\Programs\Startup\
SpywareGuard.lnk - C:\Program Files\SpywareGuard\sgmain.exe [2003-08-29 18:05:35]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 04:44:06]
NkbMonitor.exe.lnk - C:\Program Files\Nikon\PictureProject\NkbMonitor.exe [2006-04-02 21:45:46]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegedit"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run]
"{2010146B-0A64-1033-0507-030416030001}"= "C:\Program Files\Common Files\{2010146B-0A64-1033-0507-030416030001}\Update.exe" te-110-12-0000132

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli scecli scecli

R0 avgntmgr;avgntmgr;C:\WINDOWS\System32\DRIVERS\avgntmgr.sys [2007-07-18 14:22]
R1 avgntdd;avgntdd;C:\WINDOWS\System32\DRIVERS\avgntdd.sys [2007-08-09 13:04]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\14ca49e4-f5a0-4a28-83d1-b8845ab13a03]
C:\WINDOWS\System32\rdmxcom.exe
.
Contents of the 'Scheduled Tasks' folder
"2008-01-11 16:16:04 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-24 21:01:37
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-24 21:08:03 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-25 02:08:00
ComboFix2.txt 2008-01-19 17:35:37
ComboFix3.txt 2008-01-15 04:32:02

little eagle

Post #12January 25, 2008, 4:00 AM UTC

Please read the instructions again how to install the Recovery Console:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix.

——————————————————————

Open notepad and copy/paste the text in the codebox below into it:

[b]RenV::[/b]C:\Program Files\Zone Labs\ZoneAlarm\zlclient .exe

Save this as Save this as "CFScript"

[external image: Posted Image]

Refering to the picture above, drag CFScript.txt into ComboFix.exe

Then post the results log and a new HijackThis log.

Rio

Post #13January 26, 2008, 1:32 AM UTC

Attached requested logs

ComboFix 08-01-23.1C - Mom & Dad 2008-01-25 20:09:08.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.1.1252.1.1033.18.276 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat

—– BITS: Possible infected sites —–

hxxp://80.93.59.108
hxxp://eservicesupport.us.dell.com
.
((((((((((((((((((((((((( Files Created from 2007-12-26 to 2008-01-26 )))))))))))))))))))))))))))))))
.

2008-01-25 20:08 . 2000-08-31 08:00 51,200 –a—— C:\WINDOWS\Nircmd.exe
2008-01-20 22:10 . 2008-01-20 22:10 1,632,768 –a—— C:\WINDOWS\SYSTEM32\22C.tmp
2008-01-20 18:47 . 2007-06-08 09:44 8,576 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\RkPavProc.sys
2008-01-20 16:47 . 2008-01-20 22:10 30,590 –a—— C:\WINDOWS\SYSTEM32\pavas.ico
2008-01-20 16:47 . 2008-01-20 22:10 2,550 –a—— C:\WINDOWS\SYSTEM32\Uninstall.ico
2008-01-20 16:47 . 2008-01-20 22:10 1,406 –a—— C:\WINDOWS\SYSTEM32\Help.ico
2008-01-20 14:39 . 2008-01-20 14:39 d——– C:\nup
2008-01-20 14:38 . 2008-01-20 14:38 d——– C:\Program Files\EsetOnlineScanner
2008-01-20 14:23 . 2008-01-20 14:23 d——– C:\Program Files\Avira
2008-01-20 13:59 . 2007-11-14 16:05 75,248 –a—— C:\WINDOWS\zllsputility.exe
2008-01-20 13:58 . 2007-11-14 16:05 1,086,952 –a—— C:\WINDOWS\SYSTEM32\zpeng24.dll
2008-01-20 13:58 . 2008-01-25 20:17 353,366 –a—— C:\WINDOWS\SYSTEM32\vsconfig.xml
2008-01-20 13:42 . 2008-01-20 13:42 d——– C:\Program Files\ZoneAlarmSB
2008-01-09 20:00 . 2008-01-20 20:41 d——– C:\Program Files\RcvSystem
2007-12-30 20:26 . 2008-01-20 22:44 d——– C:\Program Files\iTunes
2007-12-30 20:26 . 2007-12-30 20:26 d——– C:\Program Files\iPod
2007-12-30 15:38 . 2008-01-19 12:25 d——– C:\Program Files\QuickTime
2007-12-30 15:36 . 2007-12-30 15:36 d——– C:\Program Files\Apple Software Update

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-21 04:12 ——— d—–w C:\Program Files\SpywareGuard
2008-01-20 19:29 ——— d—–w C:\Program Files\SpywareBlaster
2008-01-20 18:37 ——— d—–w C:\Program Files\SRN Micro
2008-01-04 12:33 ——— d—–w C:\Program Files\WebHost
2007-12-28 02:55 ——— d—–w C:\Program Files\EA GAMES
2007-12-26 01:03 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-12-26 01:03 ——— d—–w C:\Program Files\Nancy Drew
2007-12-15 18:25 ——— d—–w C:\Program Files\Common Files\Corel
2007-12-15 18:23 ——— d—–w C:\Program Files\Corel
2006-05-27 13:55 42,649 —-a-w C:\WINDOWS\Internet Logs\zlclient_2nd_2006_05_27_09_30_28_small.dmp.zip
2004-07-18 05:54 460,728 —-a-w C:\WINDOWS\Fonts\SET675.tmp
2004-07-18 05:54 460,728 —-a-w C:\WINDOWS\Fonts\SET5B1.tmp
2004-07-18 05:54 460,728 —-a-w C:\WINDOWS\Fonts\SET4C4.tmp
2004-07-18 05:54 383,140 —-a-w C:\WINDOWS\Fonts\SET674.tmp
2004-07-18 05:54 383,140 —-a-w C:\WINDOWS\Fonts\SET5B0.tmp
2004-07-18 05:54 383,140 —-a-w C:\WINDOWS\Fonts\SET4C3.tmp
2004-07-18 05:54 355,436 —-a-w C:\WINDOWS\Fonts\SET673.tmp
2004-07-18 05:54 355,436 —-a-w C:\WINDOWS\Fonts\SET5AF.tmp
2004-07-18 05:54 355,436 —-a-w C:\WINDOWS\Fonts\SET4C2.tmp
2004-07-17 18:39 409,280 —-a-w C:\WINDOWS\Fonts\SET672.tmp
2004-07-17 18:39 409,280 —-a-w C:\WINDOWS\Fonts\SET5AE.tmp
2004-07-17 18:39 409,280 —-a-w C:\WINDOWS\Fonts\SET4C1.tmp
2004-07-17 18:39 398,372 —-a-w C:\WINDOWS\Fonts\SET671.tmp
2004-07-17 18:39 398,372 —-a-w C:\WINDOWS\Fonts\SET5AD.tmp
2004-07-17 18:39 398,372 —-a-w C:\WINDOWS\Fonts\SET4C0.tmp
2004-07-17 18:39 367,112 —-a-w C:\WINDOWS\Fonts\SET678.tmp
2004-07-17 18:39 367,112 —-a-w C:\WINDOWS\Fonts\SET5B4.tmp
2004-07-17 18:39 367,112 —-a-w C:\WINDOWS\Fonts\SET4C7.tmp
2004-07-17 18:39 352,224 —-a-w C:\WINDOWS\Fonts\SET677.tmp
2004-07-17 18:39 352,224 —-a-w C:\WINDOWS\Fonts\SET5B3.tmp
2004-07-17 18:39 352,224 —-a-w C:\WINDOWS\Fonts\SET4C6.tmp
2004-07-17 18:39 127,596 —-a-w C:\WINDOWS\Fonts\SET676.tmp
2004-07-17 18:39 127,596 —-a-w C:\WINDOWS\Fonts\SET5B2.tmp
2004-07-17 18:39 127,596 —-a-w C:\WINDOWS\Fonts\SET4C5.tmp
.

—-a-w		   919,016 2008-01-19 17:12:07  C:\Program Files\Zone Labs\ZoneAlarm\zlclient .exe

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA}]
2008-01-20 13:42 262144 –a—— C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{8E718888-423F-11D2-876E-00A0C9082467}
{EF99BD32-C1FB-11D2-892F-0090271D4F88}
{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}

[HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}"= C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL [2008-01-20 13:42 262144]

[HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"diagent"="C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" [2008-01-19 12:12 135264]
"AdaptecDirectCD"="C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" [2008-01-19 12:11 684032]
"DeviceDiscovery"="C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe" [2008-01-19 12:11 40960]
"HPDJ Taskbar Utility"="C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe" [2008-01-19 12:11 172032]
"Synchronization Manager"="C:\WINDOWS\system32\mobsync.exe" [2002-08-29 05:00 135680]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-01-19 12:11 151597]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask .exe" [ ]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-01-19 12:12 267048]
"Corel Photo Downloader"="C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader .exe" [ ]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-11-14 16:05 919016]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-01-20 14:28 249896]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"The Intranet"="intranet.exe" []

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunServices]
"The Intranet"="intranet.exe" []

C:\Documents and Settings\Mom & Dad\Start Menu\Programs\Startup\
SpywareGuard.lnk - C:\Program Files\SpywareGuard\sgmain.exe [2003-08-29 18:05:35 360448]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 04:44:06 29696]
NkbMonitor.exe.lnk - C:\Program Files\Nikon\PictureProject\NkbMonitor.exe [2006-04-02 21:45:46 118784]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegedit"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run]
"{2010146B-0A64-1033-0507-030416030001}"= "C:\Program Files\Common Files\{2010146B-0A64-1033-0507-030416030001}\Update.exe" te-110-12-0000132

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli scecli scecli

R0 avgntmgr;avgntmgr;C:\WINDOWS\System32\DRIVERS\avgntmgr.sys [2007-07-18 14:22]
R1 avgntdd;avgntdd;C:\WINDOWS\System32\DRIVERS\avgntdd.sys [2007-08-09 13:04]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\14ca49e4-f5a0-4a28-83d1-b8845ab13a03]
C:\WINDOWS\System32\rdmxcom.exe
.
Contents of the 'Scheduled Tasks' folder
"2008-01-25 16:16:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-25 20:18:07
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-25 20:24:29 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-26 01:24:26
ComboFix2.txt 2008-01-25 02:08:04

Logfile of HijackThis v1.99.1
Scan saved at 20:34, on 2008-01-25
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\System32\PSIService.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://smbusiness.dellnet.com/
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O4 - HKLM\..\Run: [diagent] "C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" startup
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask .exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Corel Photo Downloader] "C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader .exe" -startup
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall-beta.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/oas/ActiveX/MSDcode.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab
O16 - DPF: {55027008-315F-4F45-BBC3-8BE119764741} (Slide Image Uploader Control) - http://www.slide.com/uploader/SlideImageUploader.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zonelabs.com/bin/promotion…canner37500.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B49C4597-8721-4789-9250-315DFBD9F525} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/radio/ampx/ampx2.6.1.11_en_dl.cab
O16 - DPF: {D3D83E08-54D1-4E9D-8EAF-9F979D139294} (MaxisSimCityScapeTeleX Control) - http://simcity.ea.com/scape/teleport/Maxis…yScapeTeleX.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/d…/ITDetector.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\System32\PSIService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

little eagle

Post #14January 26, 2008, 2:42 AM UTC

Please remove Zonealarm from your PC and activate windows firewall for now. Reboot rescan with hijackthis and post a new log.

Rio

Post #15January 26, 2008, 3:35 AM UTC

Removed Zone Alarm. HJT log attached.

Logfile of HijackThis v1.99.1
Scan saved at 22:36, on 2008-01-25
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\PSIService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://smbusiness.dellnet.com/
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O4 - HKLM\..\Run: [diagent] "C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" startup
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask .exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Corel Photo Downloader] "C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader .exe" -startup
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall-beta.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/oas/ActiveX/MSDcode.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab
O16 - DPF: {55027008-315F-4F45-BBC3-8BE119764741} (Slide Image Uploader Control) - http://www.slide.com/uploader/SlideImageUploader.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zonelabs.com/bin/promotion…canner37500.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B49C4597-8721-4789-9250-315DFBD9F525} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/radio/ampx/ampx2.6.1.11_en_dl.cab
O16 - DPF: {D3D83E08-54D1-4E9D-8EAF-9F979D139294} (MaxisSimCityScapeTeleX Control) - http://simcity.ea.com/scape/teleport/Maxis…yScapeTeleX.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/d…/ITDetector.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\System32\PSIService.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] Blue Screen

✨ Ask AI

Ask AI